Privacy policy

1. Controller and processor

ShopDesk is used by online stores (the "Merchant"). For customers' order data the Merchant is the controller and the operator of ShopDesk is a processor. For Merchant accounts (user name, email, password hash, logs) the operator of ShopDesk is the controller.

2. Data processed

• Order data: order number, status, items, shipping address, customer email (also hashed), phone, locale.
• Case data: withdrawal statements, return, claim and cancellation requests, messages, attachments.
• Technical data: hashed IP, user agent, session ids, request ids, logs.

3. Purposes and legal bases

Performance of a contract (after-sales handling), legal obligation (EU 2023/2673 online withdrawal, accounting retention), legitimate interest (security, abuse prevention).

4. Retention

• Raw webhook payloads: 30 days.
• Delivery and notification logs: 90 days.
• Portal login codes: minutes; sessions: deleted after expiry.
• Audit log: 24 months.
• Attachments: 180 days after case closure.
• Order data: per the Merchant's retention rules; anonymised on the Merchant's request.

5. Recipients, subprocessors

The subprocessor list is published on a separate page. Data is stored within the EU.

6. Data subject rights

Access, rectification, erasure, restriction, portability, objection. Customers should contact the Merchant; ShopDesk exports or anonymises on the Merchant's instruction. Contact: hello@shopdesk.listpro.hu.

7. Security

Encrypted transport, encrypted credentials, role-based access, two-factor authentication for the operator panel, audit log, daily backups.